@aws-blocks/bb-distributed-data 0.1.6 → 0.1.8

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAA0D,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAQpD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAG7D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAgGhF;;;;;OAKG;IACH,SAAS,IAAI,KAAK;CAGnB;AAaD,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAA0E,MAAM,sBAAsB,CAAC;AACrH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AASpD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAG7D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAwGhF;;;;;OAKG;IACH,SAAS,IAAI,KAAK;CAGnB;AAaD,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.cdk.js

@@ -5,10 +5,11 @@
  * Provisions Aurora DSQL cluster via CloudFormation.
  * Optionally runs migrations via a CustomResource Lambda.
  */
-import { Scope, DEFAULT_NODE_RUNTIME, synthGuard, blocksNodejsBundling } from '@aws-blocks/core/cdk';
+import { Scope, DEFAULT_NODE_RUNTIME, synthGuard, blocksNodejsBundling, registerConfig } from '@aws-blocks/core/cdk';
 import * as cdk from 'aws-cdk-lib';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda-nodejs';
+import { LogGroup } from 'aws-cdk-lib/aws-logs';
 import * as cr from 'aws-cdk-lib/custom-resources';
 import { createHash } from 'node:crypto';
 import { readdirSync, readFileSync } from 'node:fs';
@@ -39,17 +40,19 @@ export class DistributedDatabase extends Scope {
         });
         cluster.applyRemovalPolicy(removalPolicy);
         const endpoint = cluster.getAtt('Endpoint').toString();
-        // Env vars for runtime
-        this.handler.addEnvironment(`BLOCKS_${envName}_ENDPOINT`, endpoint);
-        this.handler.addEnvironment(`BLOCKS_${envName}_REGION`, region);
-        // IAM grant — app Lambda gets DML-only access via custom DB role (least privilege)
-        this.handler.addToRolePolicy(new iam.PolicyStatement({
+        // Config for runtime — flows through S3 config (loaded into process.env at
+        // cold start) like every other block, instead of a direct env var.
+        registerConfig(this, `BLOCKS_${envName}_ENDPOINT`, endpoint);
+        registerConfig(this, `BLOCKS_${envName}_REGION`, region);
+        // IAM grant — the shared execution role gets DML-only access via custom DB
+        // role (least privilege).
+        this.executionRole.addToPrincipalPolicy(new iam.PolicyStatement({
             actions: ['dsql:DbConnect'],
             resources: [`arn:aws:dsql:${region}:${stack.account}:cluster/${cluster.ref}`],
         }));
         new cdk.CfnOutput(stack, `${this.fullId}DsqlEndpoint`, { value: endpoint });
-        // The app Lambda's IAM role ARN is needed to map the custom DB role.
-        const appRoleArn = this.handler.role.roleArn;
+        // The shared execution role ARN is mapped to the custom DB role.
+        const appRoleArn = this.executionRole.roleArn;
         // Resolve migrations path if provided
         const resolvedMigrationsPath = options?.migrationsPath ? resolve(options.migrationsPath) : undefined;
         const migrationsHash = resolvedMigrationsPath ? hashMigrationsDir(resolvedMigrationsPath) : 'no-migrations';
@@ -62,6 +65,12 @@ export class DistributedDatabase extends Scope {
             handler: 'handler',
             runtime: DEFAULT_NODE_RUNTIME,
             timeout: cdk.Duration.minutes(MIGRATION_LAMBDA_TIMEOUT_MINUTES),
+            // Own the migration Lambda's log group so its retention follows the
+            // stack-wide default instead of AWS's infinite retention.
+            logGroup: new LogGroup(stack, `${this.fullId}DsqlMigrationLogs`, {
+                retention: this.defaults.logRetention,
+                removalPolicy: cdk.RemovalPolicy.DESTROY,
+            }),
             environment: {
                 DSQL_ENDPOINT: endpoint,
                 DSQL_REGION: region,

package/dist/index.cdk.test.js

@@ -18,12 +18,17 @@ const MIGRATIONS_DIR = '.bb-data/__test_cdk_migrations__';
 function synth(build) {
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'TestStack');
+    const executionRole = new cdk.aws_iam.Role(stack, 'BlocksRole', {
+        assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+    });
     const handler = new lambda.Function(stack, 'Handler', {
         runtime: DEFAULT_NODE_RUNTIME,
         handler: 'index.handler',
         code: lambda.Code.fromInline('exports.handler = async () => {};'),
+        role: executionRole,
     });
     stack.handler = handler;
+    stack.executionRole = executionRole;
     globalThis.CURRENT_BLOCKS_STACK = stack;
     try {
         build(stack);
@@ -59,13 +64,18 @@ test('CDK: per-block removalPolicy is independent of deletion protection', () =>
     // RETAINed on stack delete but not deletion-protected.
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'IndepStack');
+    const executionRole = new cdk.aws_iam.Role(stack, 'BlocksRole', {
+        assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+    });
     const handler = new lambda.Function(stack, 'Handler', {
         runtime: DEFAULT_NODE_RUNTIME,
         handler: 'index.handler',
         code: lambda.Code.fromInline('exports.handler = async () => {};'),
+        role: executionRole,
     });
     stack.handler = handler;
     stack.defaults = BlocksPresets.sandbox;
+    stack.executionRole = executionRole;
     globalThis.CURRENT_BLOCKS_STACK = stack;
     try {
         new DistributedDatabase(scope(stack), 'mydsql', { removalPolicy: 'retain' });
@@ -82,15 +92,20 @@ test('CDK: per-block removalPolicy is independent of deletion protection', () =>
 test('CDK: sandbox defaults disable deletion protection', () => {
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'SandboxStack');
+    const executionRole = new cdk.aws_iam.Role(stack, 'BlocksRole', {
+        assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+    });
     const handler = new lambda.Function(stack, 'Handler', {
         runtime: DEFAULT_NODE_RUNTIME,
         handler: 'index.handler',
         code: lambda.Code.fromInline('exports.handler = async () => {};'),
+        role: executionRole,
     });
     stack.handler = handler;
     // The cluster's removal/protection follows the stack-wide defaults (resolved
     // via the globalThis fallback here), not the sandboxMode context.
     stack.defaults = BlocksPresets.sandbox;
+    stack.executionRole = executionRole;
     globalThis.CURRENT_BLOCKS_STACK = stack;
     try {
         new DistributedDatabase(scope(stack), 'mydsql');
@@ -120,18 +135,36 @@ test('CDK: handler gets dsql:DbConnect policy (least privilege)', () => {
         },
     });
 });
-// --- Environment variables ---
-test('CDK: handler gets ENDPOINT and REGION env vars', () => {
-    const template = synth((stack) => {
-        new DistributedDatabase(scope(stack), 'mydsql');
+// --- Runtime config (endpoint + region) ---
+test('CDK: registers ENDPOINT and REGION via the config registry (not handler env vars)', () => {
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'TestStack');
+    const executionRole = new cdk.aws_iam.Role(stack, 'BlocksRole', {
+        assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
     });
-    const fns = template.findResources('AWS::Lambda::Function');
-    const handlerFn = Object.entries(fns).find(([id]) => id.startsWith('Handler'));
-    assert.ok(handlerFn, 'Handler Lambda should exist');
-    const env = handlerFn[1].Properties?.Environment?.Variables ?? {};
-    const envKeys = Object.keys(env);
-    assert.ok(envKeys.some(k => k.includes('ENDPOINT')), `Expected ENDPOINT env var, got: ${envKeys}`);
-    assert.ok(envKeys.some(k => k.includes('REGION')), `Expected REGION env var, got: ${envKeys}`);
+    const handler = new lambda.Function(stack, 'Handler', {
+        runtime: DEFAULT_NODE_RUNTIME,
+        handler: 'index.handler',
+        code: lambda.Code.fromInline('exports.handler = async () => {};'),
+        role: executionRole,
+    });
+    stack.handler = handler;
+    stack.executionRole = executionRole;
+    globalThis.CURRENT_BLOCKS_STACK = stack;
+    try {
+        new DistributedDatabase(scope(stack), 'mydsql');
+        // Endpoint + region now flow through the config registry (loaded into
+        // process.env at cold start) like every other block — not a direct env var
+        // on the handler.
+        const registry = stack[Symbol.for('BLOCKS_CONFIG_REGISTRY')];
+        assert.ok(registry, 'config registry exists on the stack');
+        const keys = [...registry.entries.keys()];
+        assert.ok(keys.some(k => k.includes('ENDPOINT')), `Expected an ENDPOINT config key, got: ${keys}`);
+        assert.ok(keys.some(k => k.includes('REGION')), `Expected a REGION config key, got: ${keys}`);
+    }
+    finally {
+        delete globalThis.CURRENT_BLOCKS_STACK;
+    }
 });
 // --- CfnOutput ---
 test('CDK: stack has endpoint output', () => {
@@ -156,6 +189,33 @@ test('CDK: migration/provisioning resources always created', () => {
     const hasDsqlGrant = policyValues.some((p) => JSON.stringify(p).includes('dsql:DbConnectAdmin'));
     assert.ok(hasDsqlGrant, 'Migration Lambda should have dsql:DbConnectAdmin');
 });
+test('CDK: DSQL migration Lambda log group adopts defaults.logRetention', () => {
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'DsqlMigrationRetentionStack');
+    const executionRole = new cdk.aws_iam.Role(stack, 'BlocksRole', {
+        assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+    });
+    const handler = new lambda.Function(stack, 'Handler', {
+        runtime: DEFAULT_NODE_RUNTIME,
+        handler: 'index.handler',
+        code: lambda.Code.fromInline('exports.handler = async () => {};'),
+        role: executionRole,
+    });
+    stack.handler = handler;
+    stack.executionRole = executionRole;
+    stack.defaults = BlocksPresets.sandbox;
+    globalThis.CURRENT_BLOCKS_STACK = stack;
+    try {
+        new DistributedDatabase(scope(stack), 'mydsql');
+        const template = Template.fromStack(stack);
+        // The always-created migration Lambda now owns an explicit log group whose
+        // retention follows the stack-wide default (sandbox → one week).
+        template.hasResourceProperties('AWS::Logs::LogGroup', { RetentionInDays: 7 });
+    }
+    finally {
+        delete globalThis.CURRENT_BLOCKS_STACK;
+    }
+});
 test('CDK: migration resources created when migrationsPath is provided', () => {
     rmSync(MIGRATIONS_DIR, { recursive: true, force: true });
     mkdirSync(MIGRATIONS_DIR, { recursive: true });

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "DistributedDatabase";
-export declare const BB_VERSION = "0.1.6";
+export declare const BB_VERSION = "0.1.8";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'DistributedDatabase';
-export const BB_VERSION = '0.1.6';
+export const BB_VERSION = '0.1.8';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-blocks/bb-distributed-data",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -37,9 +37,9 @@
     "test": "node --test 'dist/**/*.test.js'"
   },
   "dependencies": {
-    "@aws-blocks/core": "^0.2.0",
+    "@aws-blocks/core": "^0.4.0",
     "@aws-blocks/data-common": "^0.1.4",
-    "@aws-blocks/bb-logger": "^0.1.4",
+    "@aws-blocks/bb-logger": "^0.1.6",
     "@aws-sdk/dsql-signer": "^3.700.0",
     "@electric-sql/pglite": "^0.2.0",
     "pg": "^8.13.0"